Class AwsKmsProvider

constructor

• new AwsKmsProvider(options: AwsKmsOptions): AwsKmsProvider

  Create an AWS KMS provider with the given options.

  Parameters

  • options: AwsKmsOptions

  Returns AwsKmsProvider

Readonlyname

listKeys

• listKeys(
      _filters?: { usage?: string; enabled?: boolean },
  ): Promise<KmsKeyMetadata[]>

  List all KMS keys, optionally filtered by usage or enabled state.

  Parameters

  • Optional_filters: { usage?: string; enabled?: boolean }

  Returns Promise<KmsKeyMetadata[]>

getKey

• getKey(keyId: string): Promise<KmsKeyMetadata>

  Retrieve metadata for a specific KMS key by ID.

  Parameters

  • keyId: string

  Returns Promise<KmsKeyMetadata>

createKey

• createKey(
      algorithm: string,
      usage: "encrypt" | "sign" | "wrap",
      metadata?: Record<string, string>,
  ): Promise<KmsKeyMetadata>

  Create a new KMS key with the given algorithm and usage.

  Parameters

  • algorithm: string
  • usage: "encrypt" | "sign" | "wrap"
  • Optionalmetadata: Record<string, string>

  Returns Promise<KmsKeyMetadata>

enableKey

• enableKey(keyId: string): Promise<void>

  Enable a previously disabled KMS key.

  Parameters

  • keyId: string

  Returns Promise<void>

disableKey

• disableKey(keyId: string): Promise<void>

  Disable a KMS key so it cannot be used for operations.

  Parameters

  • keyId: string

  Returns Promise<void>

scheduleKeyDeletion

• scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>

  Schedule a KMS key for deletion after a pending window.

  Parameters

  • keyId: string
  • pendingWindowDays: number = 30

  Returns Promise<void>

encrypt

• encrypt(
      keyId: string,
      plaintext: Uint8Array,
      context?: Record<string, string>,
  ): Promise<KmsEncryptResult>

  Encrypt plaintext using a KMS key, with optional encryption context.

  Parameters

  • keyId: string
  • plaintext: Uint8Array
  • Optionalcontext: Record<string, string>

  Returns Promise<KmsEncryptResult>

decrypt

• decrypt(
      keyId: string,
      ciphertext: string,
      context?: Record<string, string>,
  ): Promise<KmsDecryptResult>

  Decrypt ciphertext using a KMS key, with optional encryption context.

  Parameters

  • keyId: string
  • ciphertext: string
  • Optionalcontext: Record<string, string>

  Returns Promise<KmsDecryptResult>

sign

• sign(
      keyId: string,
      data: Uint8Array,
      algorithm?: string,
  ): Promise<KmsSignResult>

  Sign data using a KMS signing key.

  Parameters

  • keyId: string
  • data: Uint8Array
  • algorithm: string = "RSASSA_PSS_SHA_256"

  Returns Promise<KmsSignResult>

verify

• verify(
      keyId: string,
      data: Uint8Array,
      signature: string,
      algorithm?: string,
  ): Promise<boolean>

  Verify a signature against data using a KMS signing key.

  Parameters

  • keyId: string
  • data: Uint8Array
  • signature: string
  • algorithm: string = "RSASSA_PSS_SHA_256"

  Returns Promise<boolean>

rotateKey

• rotateKey(keyId: string): Promise<KmsKeyMetadata>

  Enable automatic key rotation and return updated metadata.

  Parameters

  • keyId: string

  Returns Promise<KmsKeyMetadata>

generateDataKey

• generateDataKey(
      keyId: string,
      keySpec?: string,
  ): Promise<{ plaintext: Uint8Array; ciphertext: string }>

  Generate a data encryption key (DEK) wrapped by the managed key.

  Parameters

  • keyId: string
  • keySpec: string = "AES_256"

  Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>